BIOS Update to allow Windows update to apply the 2023 Secure Boot Certificate

[dmm25]

Good to know, Paul.  Since I'm done with the mission-critical task of submitting my taxes, I have a little time to experiment with the unsupported W11 upgrade on my tower.  If I turn it into an expensive doorstop, at least I have a similarly configured HP laptop as a backup while I'm shopping for my ultra cool new system...for which I'm sure Microsoft and the OEM have already secretly planned obsolescence. 😏

[Paul_Tikkanen]

Anytime.

If I felt that your PC would not do well trying the W11 upgrade, I wouldn't have suggested it.

I'll probably hold off on buying a new PC until we find out what Microsoft's plans are regarding W12 if it comes to be.

I'm sure the hardware requirements will be more restrictive, and my old trusty PC's will end their lives on W11.

I bought that Dell PC on eBay off lease in 2019, and paid around $500 for it, and a year or so later Microsoft came out and drew the line at Intel 8th gen core processors for W11 and here's my PC with an i7-7700 as e-waste?

I think not.

There were a lot of unhappy folks with Intel 6th and 7th gens that argued with Microsoft about that restriction and Microsoft wouldn't budge.

I also have a HP 800 G3 desktop mini-PC with an i5-6500T processor and the first thing I did when I got it was to install W11.

A nice bargain PC for a mere $65 on eBay.

I couldn't say no.

[Prometheus12]

I have an HP Pavilion 15-ab292nr which is from 2016, has an Intel I7 6700HQ processor, DDR3 memory, and it received the new 2023 Secure Boot keys. It is running Windows 11 25H2.  I had to use the registry changes to allow for an unsupported processor, and it still runs fine.  There are possibly some BIOS settings that may need to be changed or reset in order to get the new keys installed, but I am certain that if the computer has both Secure Boot enabled and Legacy Support disabled, it should update. Now my HP Z Book 17 G5 from 2018 has a specific pause on getting the new keys until HP and Microsoft come up with a solution, as stated in the latest update to the Windows Security Dashboard. Click on Device Security and there is now a Secure Boot status that appears in the menu. For mine, it is just a waiting game. 

[Paul_Tikkanen]

Update:

Just for kicks, I re-ran the I ran the Powershell command as administrator, and now received the 'True' report on my Dell Optiplex 7050 MT.

So, somewhere between March 6th and now, Windows updated the secure boot certificates.

[ForumGuy]

Hi.

I applied the procedure delineated in the first post here:  Re: Enabling new UEFI 2023 CA certificates in pre-2018 HP co... - HP Support Community - 9628370

Do exactly as was told there and you will most probably be O.K.

You should also note:

1- If you have HP Sure Start, this BIOS setting protects Secure Boot keys. You must disable it.

2- HP Secure Boot PK (Platform Key) was not accepted in my notebook. If this happens, you should continue with remaining certificate installations.

3- After every BIOS setting change you must reboot.

If you have any questions, please do not hesitate to ask.

You should also know this: Whatever you do, you are doing it at your very own risk.

Good luck